Appendix F
Causal Tree Analysis of December 3-5, 2000, Event at JACADS

A standard tool in reliability analysis, the causal tree or event tree is particularly useful in analyzing incidents to which operator actions contribute either positively or negatively. The committee recognizes that such trees are designed at the discretion of the analyst and should not be construed as reflecting scientific certainty. Therefore, Figure F-1, the causal tree for the December 3-5, 2000, event at JACADS, is provided for illustrative purposes. This analysis suggests that the incidents examined by the committee grew from normal activities into potentially dangerous events.

The activities charted can be categorized as ranging from normal operations through system response. In addition, some can extend back in time before the occurrence of the incident, e.g., latent failures.

  • Normal tasks—tasks that the system was attempting to accomplish before the adverse event occurred. Examples are maintenance and operations.

  • Latent failures—conditions present in the system for some time before the incident, but evident only when triggered by unusual states or events. Examples include equipment design deficiencies, unexpected configurations of munitions, or routine ignoring of standard operating procedures.

  • Active failures—events before which there were no adverse consequences and after which there were. Active failures are usually the result of personnel decisions or actions. These same actions may have resulted in safe outcomes on previous occasions, but in the incidents examined by the committee, such actions combined with latent failures to cause some adverse consequences. Examples of active failures include use of the wrong procedure, incorrect performance of an appropriate procedure, or failure to correctly and rapidly diagnose a problem.

  • Immediate outcome—the adverse state the system reached immediately after the active failure. Examples are release of agent, plant damage, or personal injury. Reporting and investigation flow charts supplied by the Army indicate that the severity of outcome often determines the incident’s prominence for managers, the workforce, or the local community, which in turn drives subsequent responses. Incidents with more salient outcomes naturally receive more scrutiny, which may bias the data set used for analysis.

  • System responses—actions taken to correct the effects and anticipate the aftereffects of an adverse outcome. Following each event, however, there is a system response that also needs to be analyzed. How did the system for incident response function? How did the management act to improve safety? Was an exposed worker properly treated? Were communities notified appropriately? How did the plant return to a normal state? How rapidly did it return? Finally, how was the system changed in light of the incident? This stage of analysis is considered in Chapter 4.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 103
Appendix F Causal Tree Analysis of December 3-5, 2000, Event at JACADS A standard tool in reliability analysis, the causal tree or in the incidents examined by the committee, such event tree is particularly useful in analyzing incidents to which actions combined with latent failures to cause some operator actions contribute either positively or negatively. The adverse consequences. Examples of active failures committee recognizes that such trees are designed at the dis- include use of the wrong procedure, incorrect per- cretion of the analyst and should not be construed as reflecting formance of an appropriate procedure, or failure to scientific certainty. Therefore, Figure F-1, the causal tree for correctly and rapidly diagnose a problem. the December 3-5, 2000, event at JACADS, is provided for • Immediate outcome—the adverse state the system illustrative purposes. This analysis suggests that the incidents reached immediately after the active failure. Ex- examined by the committee grew from normal activities into amples are release of agent, plant damage, or per- potentially dangerous events. sonal injury. Reporting and investigation flow charts The activities charted can be categorized as ranging supplied by the Army indicate that the severity of from normal operations through system response. In addi- outcome often determines the incident’s prominence tion, some can extend back in time before the occurrence of for managers, the workforce, or the local commu- the incident, e.g., latent failures. nity, which in turn drives subsequent responses. In- cidents with more salient outcomes naturally receive • Normal tasks—tasks that the system was attempting more scrutiny, which may bias the data set used for to accomplish before the adverse event occurred. Ex- analysis. amples are maintenance and operations. • System responses—actions taken to correct the ef- • Latent failures—conditions present in the system for fects and anticipate the aftereffects of an adverse out- some time before the incident, but evident only when come. Following each event, however, there is a triggered by unusual states or events. Examples system response that also needs to be analyzed. How include equipment design deficiencies, unexpected did the system for incident response function? How configurations of munitions, or routine ignoring of did the management act to improve safety? Was an standard operating procedures. exposed worker properly treated? Were communi- • Active failures—events before which there were no ties notified appropriately? How did the plant return adverse consequences and after which there were. to a normal state? How rapidly did it return? Fi- Active failures are usually the result of personnel nally, how was the system changed in light of the decisions or actions. These same actions may have incident? This stage of analysis is considered in resulted in safe outcomes on previous occasions, but Chapter 4. 103

OCR for page 103
Normal Tasks Latent Failures Active Failures Immediate Outcomes System Responses 104 Spill pillows placed at PDS to catch SOP for spill pillow change- Spill pillows remain in place for the Spill pillows are saturated with liquid (presumably agent "drips" during mine processing. out is not established. entire mine campaign. all agent VX). Spill pillows from PDS placed in bags Spill pillows are not drained to and weighed. qualify as bulk solid waste. Assumed 5X destruction Assumed false positive when efficiency in all cases. analyses indicate agent present. Process demonstrated 5X HDC bin enclosure is not destruction efficiency. monitored for presence of agent. Knowledge that some materials (i.e. rolled-up coveralls) will not completely combust in the DFS. First spill pillow is fed to DFS. Second spill pillow is fed to DFS. DFS efficiency for burning Incomplete combustion of VX spill pillows is not determined. saturated spill pillows. Third spill pillow is fed to DFS. Bin 135 is removed from the HDC VX residue passes through HDC and is deposited collection area; lid left open. in Bin 135. WCL sample #1093 is taken from Bin VX potentially released to atmosphere; workers are 135; lid closed; bin moved to pad 736. potentially exposed to VX. Analysis of sample #1093 is initiated. Analysis of sample #1093 indicates presence of Assumed interferent in sample #1093. VX. Management decides to perform a second analysis of sample #1093. Second analysis of sample #1093 is initiated. Analysis of sample #1093 indicates presence of Second analysis of sample #1093 is completed. VX. Results of second analysis of sample #1093 Operations and laboratory management decide to reported to CON. get a second sample from Bin 135. Workers are potentially exposed to VX. WCL sample #1113 taken from Bin 135. Analysis of sample #1113 is initiated. Analysis of sample #1113 confirms VX. Analysis of sample #1113 is completed. Results of analysis of sample #1113 verbally reported to shift superintendent, but not to CON utility operator. Operations and laboratory management decide to analyze a second extraction of sample #1113 for quantification. EVALUATION OF CHEMICAL EVENTS AT ARMY CHEMICAL AGENT DISPOSAL FACILITIES

OCR for page 103
A safety-first mind-set is not Only one employee dons Management instructs employees (5) to seal and instilled in all employees. appropriate personal protective move Bins 135, 130, and 137 to the UPA for head equipment. space analysis by ACAMS/DAAMS. Extraction/dilution of sample #1113 initiated. APPENDIX F Workers are potentially exposed to VX. Employees begin sealing and moving bins to UPA unloading dock. Analysis of sample #1113 confirms VX. Laboratory personnel (3) make level C entry to UPA for ACAMS survey of bins. Two of the personnel who moved the bins to the UPA unloading dock also enter the UPA in Level E. Second dilution of sample #1113 extract is prepared. Bin 135 placed in UPA. Bin 137 placed in UPA. Bin 130 placed in UPA. Analysis of second dilution of sample #1113 extraction is completed. Confirms VX. ACAMS sampling of Bin 135 is initiated. 1st ACAMS reading of 1476 TWA in Bin 135. 2nd ACAMS reading of 1121 TWA in Bin 135. Site alarm sounded & evacuation ordered. ACAMS readings negative. ACAMS sampling of other bins in UPA. Level B entry to UPA to pull DAAMS tubes. DAAMS tubes pulled. Results of final analysis of sample #1113 reported to CON. DAAMS tubes received by lab. Analysis of DAAMS tubes confirms VX. DAAMS tube analysis completed. CON notified of DAAMS analysis results. None of the potentially exposed employees Nine employees report to medical for blood collection exhibits depressed acetylcholinesterase activity. and acetylcholinesterase activity determination. Investigation team formed. Incident investigation conducted. Conclusions and recommendations reported. Implementation of recommendations. FIGURE F-1 Causal tree for December 3-5, 2000, JACADS event. 105